Archive
13 August 2019
Vulnerabilities first published on this day (UTC), newest first.
68 results · Feed
-
High 8.8
TIBCO LogLogic Log Management Intelligence Multiple Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) Vulnerabilities
The web server component of TIBCO Software Inc.'s TIBCO LogLogic Enterprise Virtual Appliance, and TIBCO LogLogic Log Management Intelligence contains multiple vulnerabilities that theoretically allow persistent and reflected cross-site scripting (XSS) attack…
-
Unscored —
Incorrect parsing validation in net/url
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a no…
-
High 7.5
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority…
-
High 7.5CVE-2019-9512 EPSS 83%
Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is qu…
-
High 7.5
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manip…
-
High 7.5CVE-2019-9516 EPSS 57%
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. S…
-
High 7.5CVE-2019-9515 EPSS 87%
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an …
-
High 7.5CVE-2019-9517 EPSS 27%
Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer…
-
High 7.5CVE-2019-9518 EPSS 25%
Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION …
-
Unscored —
An issue was discovered in 20|20 Storage 2.11.0. A Path Traversal vulnerability in the TwentyTwenty.Storage library in …
-
Unscored —
The SIP TLS module of Huawei CloudLink Phone 7900 with V600R019C10 has a TLS certificate verification vulnerability. Du…
-
Unscored —
Huawei mobile phones Hima-AL00Bhave with Versions earlier than HMA-AL00C00B175 have a signature verification bypass vul…
-
Unscored —
PCManager 9.1.3.1 has an improper authentication vulnerability. The certain driver interface of the software does not p…
-
Unscored —
ALTOOLS update service 18.1 and earlier versions contains a local privilege escalation vulnerability due to insecure pe…
-
Unscored —
Alzip 10.83 and earlier version contains a stack-based buffer overflow vulnerability, caused by improper bounds checkin…
-
Unscored —
eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative operations by unauthentica…
-
Unscored —
eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn installed allow Remote Code Execution by unauthenticated attackers wit…
-
Unscored —
eQ-3 Homematic CCU2 and CCU3 with the XML-API through 1.2.0 AddOn installed allow Remote Code Execution by unauthentica…
-
Unscored —
UniSign 2.0.4.0 and earlier version contains a stack-based buffer overflow vulnerability which can overwrite the stack …
-
Unscored —
Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users can gai…
-
Unscored —
Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users are alw…
-
Unscored —
A vulnerability has been identified in SIMATIC Drive Controller family (All versions), SIMATIC ET 200SP Open Controller…
-
Unscored —
A vulnerability has been identified in SCALANCE SC-600 (V2.0). An authenticated attacker with access to port 22/tcp as …
-
Unscored —
A vulnerability has been identified in SCALANCE SC-600 (V2.0), SCALANCE XB-200 (V4.1), SCALANCE XC-200 (V4.1), SCALANCE…
-
Unscored —
A vulnerability has been identified in SIMATIC CP 1626 (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (…
-
Unscored —
A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5)…
-
Unscored —CVE-2017-18487 Scanner template
The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.
-
Unscored —
The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues.
-
Unscored —
The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues.
-
Unscored —
The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages.
-
High 7.5
Istio ReDoS Vulnerability
Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService, HTTPAPISpecBinding, or QuotaSpecBinding API.
-
Unscored —
The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and fi…
-
Unscored —
The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature.
-
Unscored —
The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg…
-
Unscored —
The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS.
-
Unscored —CVE-2017-18490 Scanner template
The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.
-
Unscored —CVE-2017-18491 Scanner template
The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.
-
Unscored —
The contact-form-plugin plugin before 4.0.2 for WordPress has XSS.
-
Unscored —
The contact-form-plugin plugin before 3.96 for WordPress has XSS.
-
Unscored —
The contact-form-plugin plugin before 3.52 for WordPress has XSS.